ASD ISM 1787 Ensure suppliers are approved for IT and OT sourcing
What it says
Operating systems, applications, IT equipment, OT equipment and services are sourced from approved suppliers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure systems and equipment are bought from pre-approved suppliers to mitigate risks.
Ensuring that all computer systems, software, and equipment come from approved suppliers is like making sure you buy food from a trusted farmer. It reduces the risk of getting poor-quality or unsafe products that could harm your organisation. If you don't do this, you might end up with systems that are not secure, leading to data breaches or costly downtime.
Free. Save your status, tasks and notes.
Why it matters
Sourcing IT/OT from unapproved suppliers increases supply-chain compromise risk, introducing insecure systems and services that can cause breaches and outages.
How to implement
Procurement team should maintain a list of approved suppliers: Regularly review and update this list by checking with industry standards, customer reviews, and past performance.
Make sure each supplier complies with your organisation's security standards.
IT managers should ensure purchases are from the approved list: Before buying any new technology, verify with the procurement team that the supplier is on the list.
Use a checklist to confirm that the product meets all the necessary technical and security requirements.
Security officers should evaluate supplier security practices: Gather information about each supplier's cyber security measures, such as their encryption methods or how they handle data breaches.
Request certifications or reports from credible agencies like the Australian Cyber Security Centre (ACSC).
Senior management should encourage continuous improvement: Promote a culture of security by holding regular meetings to discuss supplier performance and gather employee feedback.
Implement a process for quickly removing suppliers from the list if they no longer meet security expectations.
Keep it running
Maintain an approved supplier register for OS/apps/IT/OT and services; require procurement to use it, and review approvals quarterly with documented evidence.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The approved supplier list: Request the most recent list of approved suppliers used by the organisation.
Look at
Whether the list is up-to-date and includes key details like contact information and types of products or services provided.
Good evidence
Shows a list updated within the past year, with clear notations of compliance checks.
- Check 2 of 5What an auditor asks for
Ask for
To review recent purchase orders: Request documentation for the last five major technology purchases.
Look at
Whether all purchases were made from suppliers on the approved list.
Good evidence
Is purchase orders that match the approved list without exceptions.
- Check 3 of 5What an auditor asks for
Ask for
Supplier compliance documents: Review any reports or certifications suppliers have provided, such as security audits or ISO certifications.
Look at
Whether these documents show compliance with industry standards.
Good evidence
Includes current and valid compliance documents for each supplier.
- Check 4 of 5What an auditor asks for
Ask for
Records of supplier performance reviews: Request details from the last round of supplier evaluations.
Look at
If these reviews include security and reliability assessments.
Good evidence
Is a documented evaluation that discusses both security practices and any issues encountered.
- Check 5 of 5What an auditor asks for
Ask for
To see the process for updating the supplier list: Request the policy or procedure for adding or removing suppliers from the approved list.
Look at
If it includes security checks and criteria for approval.
Good evidence
Contains a clear, formal process with defined roles and responsibilities for ensuring security compliance.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.19.
ISM-1787 requires that operating systems, applications, IT/OT equipment and services are sourced only from approved suppliers. This is a specific supplier-selection measure that fits within Annex A 5.19, which requires organisations to define and implement processes to manage information security risks when using supplier products or services. Annex A 5.19 is broader because it also covers risk management across the supplier relationship lifecycle, not just procurement restrictions.
This control partially meets A.5.21.
ISM-1787 mandates organisations to only source IT/OT products and services from approved suppliers, reducing exposure to untrusted or high-risk vendors. This control contributes to Annex A 5.21 by reducing upfront supply chain risk. Annex A 5.21 is broader as it encompasses risk management across the ICT supply chain, including upstream components and end-to-end governance.
This control depends on A.5.22.
ISM-1787 ensures IT/OT products and services are sourced from approved suppliers, establishing a controlled set of vendors. This supports Annex A 5.22, which focuses on ongoing oversight of supplier service delivery. The pre-approval of suppliers aids in monitoring supplier security practices.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-11.1Base supplier selection on proportionate cyber supply chain risk assessmentsPartially overlaps
This control partially overlaps IT.GOV-11.1.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1787 puts that selection into effect, requiring operating systems, applications, IT and OT equipment and services to be sourced from approved suppliers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.